eyeprolog 1.5.51 → 1.5.52

package/conformance-report.md

@@ -32,7 +32,7 @@ spelling therefore changes this report even when no corpus file is added or remo
 | context | 11 | 0 | 0 | 0 | 11 |
 | control | 15 | 0 | 0 | 0 | 15 |
 | explicit-tabling | 6 | 0 | 0 | 0 | 6 |
-| iso | 173 | 219 | 0 | 0 | 392 |
+| iso | 174 | 219 | 0 | 0 | 393 |
 | lists | 52 | 3 | 0 | 0 | 55 |
 | modules | 2 | 0 | 0 | 0 | 2 |
 | negation | 8 | 0 | 19 | 0 | 27 |
@@ -45,7 +45,7 @@ spelling therefore changes this report even when no corpus file is added or remo
 | terms | 26 | 3 | 0 | 0 | 29 |
 | unification | 18 | 0 | 0 | 0 | 18 |
 | variables | 16 | 7 | 0 | 0 | 23 |
-| **Total** | **495** | **274** | **19** | **21** | **809** |
+| **Total** | **496** | **274** | **19** | **21** | **810** |
 
 ## DCG conformance clarification
 

package/examples/book/README.md

@@ -234,13 +234,15 @@ npm run generate
 
 ## Chapter 39: Predicate reference
 
-- [01-answer.pl](chapter-39/01-answer.pl) — Library relations by programming role
-- [02-answer-2.pl](chapter-39/02-answer-2.pl)
-- [03-answer-3.pl](chapter-39/03-answer-3.pl)
-- [04-cost.pl](chapter-39/04-cost.pl)
-- [05-message.pl](chapter-39/05-message.pl)
-- [06-task.pl](chapter-39/06-task.pl)
-- [07-program.pl](chapter-39/07-program.pl) — Specialized library implementation notes
+- [01-elk.pl](chapter-39/01-elk.pl) — Reading static procedures
+- [02-solve.pl](chapter-39/02-solve.pl)
+- [03-answer.pl](chapter-39/03-answer.pl) — Library relations by programming role
+- [04-answer-2.pl](chapter-39/04-answer-2.pl)
+- [05-answer-3.pl](chapter-39/05-answer-3.pl)
+- [06-cost.pl](chapter-39/06-cost.pl)
+- [07-message.pl](chapter-39/07-message.pl)
+- [08-task.pl](chapter-39/08-task.pl)
+- [09-program.pl](chapter-39/09-program.pl) — Specialized library implementation notes
 
 ## Chapter 40: Running EyeProlog: command line and corpus
 

package/examples/book/chapter-39/01-elk.pl

@@ -0,0 +1,6 @@
+% From The Art of EyeProlog, Chapter 39 — Reading static procedures.
+:- public(elk/1).
+
+elk(X) :- moose(X).
+
+moose(bertha).

package/examples/book/chapter-39/02-solve.pl

@@ -0,0 +1,10 @@
+% From The Art of EyeProlog, Chapter 39.
+:- set_prolog_flag(default_procedure_access, public).
+
+solve(true) :- !.
+solve((A, B)) :- !, solve(A), solve(B).
+solve(H) :- clause(H, Body), solve(Body).
+
+elk(X) :- moose(X).
+moose(bertha).
+grazes(X) :- elk(X).

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.5.51",
+  "version": "1.5.52",
   "description": "EyeProlog turns facts and rules into answers and proofs.",
   "type": "module",
   "main": "./index.js",

package/src/iso.js

@@ -740,7 +740,13 @@ function* clauseSolutions({ solver, goal, env }, state) {
   // the default in every mode, not only under --iso-strict: assert/1,
   // retract/1, and abolish/1 already reject static procedures unconditionally,
   // and clause/2 now agrees with them.
-  if (isProcessorStaticProcedure(solver, head) || (group && !group.dynamic)) {
+  //
+  // 7.5.3 notes that a public/1 directive would be an extension, so a static
+  // procedure declared public, or any user-defined procedure when the
+  // default_procedure_access flag is public, stays readable here. Either way
+  // the procedure remains static and cannot be modified.
+  if (isProcessorStaticProcedure(solver, head) ||
+      (group && !group.dynamic && !isPublicProcedure(solver, group))) {
     throw new PrologError('permission_error(access, private_procedure)', indicator);
   }
   callableOrVariable(goal.args[1], env);
@@ -798,6 +804,13 @@ function isGrammarRuleProcedure(solver, head) {
   return !solver.isoStrict && head.name === '-->' && head.arity === 2;
 }
 
+// A user-defined procedure is readable by clause/2 when it was declared public
+// or when the processor grants access to every user-defined procedure.
+function isPublicProcedure(solver, group) {
+  if (group.public) return true;
+  return solver.prologFlags?.get('default_procedure_access')?.value?.name === 'public';
+}
+
 function isProcessorStaticProcedure(solver, head) {
   // Conjunction is an ISO control construct (7.5/Table 9) but is executed
   // directly by the solver rather than through the builtin registry.  The

package/src/parser.js

@@ -1130,7 +1130,7 @@ class Parser {
           (['char_conversion', 'set_prolog_flag'].includes(directive.name) && directive.arity === 2)
         );
         const extensionDirective = directive.type === 'compound' && (
-          (['use_module', 'meta_predicate', 'attribute', 'table'].includes(directive.name) && directive.arity === 1) ||
+          (['use_module', 'meta_predicate', 'attribute', 'table', 'public'].includes(directive.name) && directive.arity === 1) ||
           (['module', 'use_module'].includes(directive.name) && directive.arity === 2)
         );
         if (this.strictIso && extensionDirective) {

package/src/program.js

@@ -154,6 +154,10 @@ export class Program {
     this.libraryImports = [];
     this.interopPortabilityWarnings = [];
     this.dynamicPredicates = new Set();
+    // ISO 7.5.3 notes that a public/1 directive declaring user-defined
+    // procedures to be public would be an extension. Such a procedure stays
+    // static -- it cannot be modified -- but clause/2 may inspect it.
+    this.publicPredicates = new Set();
     this.multifilePredicates = new Set();
     this.discontiguousPredicates = new Set();
     this.strictIso = options.isoStrict === true;
@@ -221,6 +225,7 @@ export class Program {
       wfsDatalog: false,
       scalarFactsOnly: true,
       dynamic: this.dynamicPredicates.has(modulePredicateKey(module, name, arity)),
+      public: this.publicPredicates.has(modulePredicateKey(module, name, arity)),
       negationStratum: null,
       hasCut: false,
       cutReachable: null,
@@ -636,6 +641,7 @@ class ProgramBuilder {
     this.options = options;
     this.program = program ?? new Program([], { ...options, [DEFER_PROGRAM_BUILD]: true });
     this.declaredDynamicIndicators = new Map();
+    this.declaredPublicIndicators = new Map();
     this.declaredMultifileIndicators = new Map();
     this.declaredDiscontiguousIndicators = new Map();
     this.declaredTableIndicators = new Map();
@@ -651,7 +657,7 @@ class ProgramBuilder {
     const unit = textUnit ?? '<input>';
     let declarations = this.directiveDeclarationsByText.get(unit);
     if (!declarations) {
-      declarations = { dynamic: new Set(), multifile: new Set(), discontiguous: new Set(), table: new Set() };
+      declarations = { dynamic: new Set(), public: new Set(), multifile: new Set(), discontiguous: new Set(), table: new Set() };
       this.directiveDeclarationsByText.set(unit, declarations);
     }
     return declarations[kind];
@@ -717,6 +723,13 @@ class ProgramBuilder {
       local.add(key);
       targetSet.add(key);
       declaredMap.set(`${textUnit}\u0000${key}`, { ...indicator, key, module, textUnit });
+      if (kind === 'public') {
+        // Unlike dynamic/1, a public declaration says nothing about existence:
+        // it only grants clause/2 access. Groups created later pick the flag up
+        // from program.publicPredicates in makeGroup.
+        const existing = program.groups.get(key);
+        if (existing) existing.public = true;
+      }
       if (kind === 'dynamic') {
         // A dynamic declaration creates the procedure immediately, not only
         // when ProgramBuilder.finish() runs. Compile-time source-expansion
@@ -830,6 +843,10 @@ class ProgramBuilder {
     const module = clause.module ?? 'user';
     const textUnit = clause.textUnit ?? '<input>';
     this.addProcedureDirective(clause, 'dynamic', program.dynamicPredicates, this.declaredDynamicIndicators);
+    // public/1 is an extension, so the strict Part 1 profile does not offer it.
+    if (!program.strictIso) {
+      this.addProcedureDirective(clause, 'public', program.publicPredicates, this.declaredPublicIndicators);
+    }
     this.addProcedureDirective(clause, 'multifile', program.multifilePredicates, this.declaredMultifileIndicators);
     this.addProcedureDirective(clause, 'discontiguous', program.discontiguousPredicates, this.declaredDiscontiguousIndicators);
     this.addProcedureDirective(clause, 'table', program.tabledPredicates, this.declaredTableIndicators);

package/src/solver.js

@@ -1263,8 +1263,17 @@ function defaultPrologFlags(unknown = 'error', strictIso = false) {
     ['unknown', { value: compound(unknown, []), allowed: ['error', 'fail', 'warning'], changeable: true }],
     ['double_quotes', { value: compound('chars', []), allowed: ['chars', 'codes', 'atom'], changeable: true }],
     ['occurs_check', { value: compound('true', []), allowed: ['true', 'error'], changeable: true }],
+    // ISO 7.5.2 makes every user-defined procedure static, and therefore
+    // private, unless declared otherwise. Setting this flag to public grants
+    // clause/2 access to all of them at once, which meta-interpreters need
+    // without having to enumerate every predicate in a public/1 directive.
+    // The procedures stay static: assert/1 and retract/1 still refuse them.
+    ['default_procedure_access', { value: compound('private', []), allowed: ['private', 'public'], changeable: true }],
   ]);
-  if (strictIso) flags.delete('occurs_check');
+  if (strictIso) {
+    flags.delete('occurs_check');
+    flags.delete('default_procedure_access');
+  }
   return flags;
 }
 

package/test/conformance/ISO-IMPLEMENTATION-DEFINED.md

@@ -69,7 +69,7 @@ Status values are:
 | 7.11.2.5 | Default `double_quotes` | `chars`. | **defined** — `src/solver.js`, parser flag state. |
 | 7.12.1 | Second argument of `error/2` | The default context term is the atom `eyeprolog`. A few implementation-specific diagnostics may deliberately supply a more specific context term. | **defined** — `formalErrorTerm()` in `src/iso.js`. |
 | 7.12.2(f) | Implementation-defined representation limits | Character and character-code operations are limited to Unicode scalar values; surrogates and values above U+10FFFF are representation errors. Arity/integer values are modeled as unbounded but may hit host/resource limits. Float input overflow uses the implementation-specific `max_float`/`min_float` representation names documented by the STC-oriented tests. | **defined** — parser/ISO numeric and character guards. |
-| 8.17.1 | Implementation-defined flag value ranges | Strict mode exposes only Part 1 core flags and their standard value sets. Normal mode additionally exposes EyeProlog's `occurs_check` flag. With `bounded=false`, `max_integer` and `min_integer` have no current or selectable value and their `current_prolog_flag/2` queries fail. Valid alternative values of fixed standard flags are distinguished from invalid values so `set_prolog_flag/2` reports permission versus domain errors as prescribed. | **defined** — strict registry/flag filtering in `src/solver.js`; strict flag tests. |
+| 8.17.1 | Implementation-defined flag value ranges | Strict mode exposes only Part 1 core flags and their standard value sets. Normal mode additionally exposes EyeProlog's `occurs_check` and `default_procedure_access` flags. With `bounded=false`, `max_integer` and `min_integer` have no current or selectable value and their `current_prolog_flag/2` queries fail. Valid alternative values of fixed standard flags are distinguished from invalid values so `set_prolog_flag/2` reports permission versus domain errors as prescribed. | **defined** — strict registry/flag filtering in `src/solver.js`; strict flag tests. |
 | 8.17.3 | Other effects of `halt/0` | Terminates EyeProlog execution and returns host/process status `0`; it produces no Prolog solution. | **defined** — `HaltSignal`, `haltBuiltin()`, CLI/runner handling. |
 | 8.17.4 | Meaning/effects of `halt(Status)` | Integer `Status` is converted to the host process/runner halt code; it produces no Prolog solution. | **defined** — `haltBuiltin()`, `src/execute.js`, `src/cli.js`. |
 | 9.1.4.1 | Floating-point rounding function `rndF` | Floating values and operations use ECMAScript `Number` (IEEE-754 binary64) and the host's specified binary64 arithmetic/conversions. | **defined** — `src/iso-arithmetic.js`, `src/number-value.js`. |
@@ -121,6 +121,7 @@ families; `--iso-strict` is intended to remove their Part 1 interpretation.
 | 5.5.6 Side effects | Normal mode adds `statistics/0-2`, cleanup/library state, and optional proof/statistics host instrumentation. | The strict registry excludes Prolog-visible statistics/cleanup/library adapters; ordinary Part 1 I/O/database/flag/operator side effects remain. Host proof/statistics collection observes execution through the embedding API rather than adding a strict Prolog goal effect. **covered** — strict registry/execution regression. |
 | 5.5.7 Control constructs | `tnot/1`, `wfs_truth/2`, and normal-profile execution optimizations | `tnot/1`, `wfs_truth/2`, and the normal-profile explicit `table` declaration are absent. |
 | 5.5.8 Flags | `occurs_check` | Absent in strict mode. |
+| 5.5.8 Flags, 7.5.3 NOTE | `public/1` directive, `default_procedure_access` flag | Absent in strict mode. The 7.5.3 NOTE anticipates a `public/1` extension declaring user-defined procedures public; the flag generalizes it to all of them at once, which meta-interpreters need without annotating the interpreted program. Read access only: a public procedure stays static, so `assert`/`retract` still report `permission_error(modify, static_procedure)`, and built-ins stay private. |
 | 5.5.9 Built-in predicates | EyeProlog libraries, CLP(Z), statistics, Part 3 `phrase/2-3`, and bundled-library autoloaded predicates | Strict registry contains only the Part 1 + Corrigenda core registry. |
 | 5.5.10 Evaluable functors | Normal mode additionally accepts the EyeProlog evaluable atom `e`; the remaining arithmetic functors accepted by strict mode are the Part 1 + Corrigenda set. | Strict mode rejects `e/0` as non-evaluable and retains the Corrigendum arithmetic additions. **covered** — strict extension-boundary regression plus `src/iso-arithmetic.js`. |
 | 5.5.11 Reserved atoms | None | None. |

package/test/conformance/ISO-PROLOG-TEXT-EXECUTION-MATRIX.md

@@ -37,7 +37,7 @@ and preparation error cases.
 | --- | --- | --- |
 | 7.5.1 initial database and clause order | covered | Prepared clauses retain textual preparation order. The implementation-defined initial database/standard-procedure choices are documented separately. |
 | 7.5.2 static and dynamic procedures | covered | Source procedures are static unless declared dynamic; asserting a previously absent predicate creates a dynamic procedure; modification of protected/static procedures is rejected. |
-| 7.5.3 private and public procedures | covered | User static procedures are private to `clause/2` in every execution mode, not only under `--iso-strict`; dynamic procedures are public; standardized built-ins/control forms remain static/private. Corpus: `iso/clause_static_and_dynamic_access`, `error/iso/clause_static_user_procedure`. |
+| 7.5.3 private and public procedures | covered | User static procedures are private to `clause/2` in every execution mode, not only under `--iso-strict`; dynamic procedures are public; standardized built-ins/control forms remain static/private. The NOTE's suggested `public/1` directive is provided as an extension in normal mode, together with a `default_procedure_access` flag that declares every user-defined procedure public; both grant read access only and leave the procedures static. Corpus: `iso/clause_static_and_dynamic_access`, `iso/public_procedure_access`, `error/iso/clause_static_user_procedure`. |
 | 7.5.4 database update visibility | covered | Dynamic calls use the logical-update view: an activation continues over the clause set visible when it began, while later activations see successful assertions/retractions. `retractall/1` retains an empty dynamic procedure and `abolish/1` removes it. |
 
 The strict test `closes ISO 7.5-7.7 database, conversion, and execution rows`

package/test/conformance/README.md

@@ -140,7 +140,7 @@ Selected cases are adapted from the ISO and standard-core suites of Logtalk,
 Scryer Prolog, Trealla Prolog, and SWI-Prolog. Their upstream identifiers and licenses
 are recorded in [THIRD_PARTY.md](THIRD_PARTY.md).
 
-The corpus has 392 cases in `iso/` and 809 file-based conformance cases in total. Of those, 11 cases in `stc/` are explicitly labelled working-draft review evidence rather than normative ISO claims. The separate vendored strict-reader WG17 matrix is a deterministic regression snapshot; the live Neumerkel gate discovers the current upstream inventory at run time; release/report checks separately verify the tracked `NEUMERKEL-LATEST.md`. The generated `conformance-report.md` records local corpus totals and links to that live evidence. Together with regression, documentation-sync, API, example, and book-example checks, `npm test` is the release gate.
+The corpus has 393 cases in `iso/` and 810 file-based conformance cases in total. Of those, 11 cases in `stc/` are explicitly labelled working-draft review evidence rather than normative ISO claims. The separate vendored strict-reader WG17 matrix is a deterministic regression snapshot; the live Neumerkel gate discovers the current upstream inventory at run time; release/report checks separately verify the tracked `NEUMERKEL-LATEST.md`. The generated `conformance-report.md` records local corpus totals and links to that live evidence. Together with regression, documentation-sync, API, example, and book-example checks, `npm test` is the release gate.
 
 ## Updating expected output
 

package/test/conformance/cases/iso/public_procedure_access.pl

@@ -0,0 +1,52 @@
+% ISO 7.5.3 notes that "an additional directive public/1 that specifies some
+% user-defined procedures to be public would be an extension". EyeProlog
+% provides that directive, plus a default_procedure_access flag that grants
+% clause/2 access to every user-defined procedure at once, which a
+% meta-interpreter needs without annotating the program it interprets.
+%
+% Both are read access only. A public procedure is still static, so assert/1
+% and retract/1 continue to report permission_error(modify, static_procedure),
+% and built-in procedures stay private either way.
+% https://github.com/eyereasoner/eyeprolog/issues/96
+
+:- public(elk/1).
+elk(X) :- moose(X).
+
+moose(bertha).
+
+%% goal: declared_public(X0)
+
+declared_public(Body) :-
+    clause(elk(bertha), Body).
+
+%% goal: undeclared_sibling(X0)
+
+% moose/1 carries no declaration, so it stays private.
+undeclared_sibling(Culprit) :-
+    catch(clause(moose(_), _), error(Formal, _), true),
+    Formal = permission_error(access, private_procedure, Culprit).
+
+%% goal: public_is_not_dynamic(X0)
+
+public_is_not_dynamic(Formal) :-
+    catch(assertz(elk(clara)), error(Formal, _), true).
+
+%% goal: flag_default(X0)
+
+flag_default(Access) :-
+    current_prolog_flag(default_procedure_access, Access).
+
+%% goal: flag_opens_every_procedure(X0)
+
+flag_opens_every_procedure(Body) :-
+    set_prolog_flag(default_procedure_access, public),
+    clause(moose(bertha), Body),
+    set_prolog_flag(default_procedure_access, private).
+
+%% goal: builtins_stay_private(X0)
+
+builtins_stay_private(Culprit) :-
+    set_prolog_flag(default_procedure_access, public),
+    catch(clause(atom(_), _), error(Formal, _), true),
+    set_prolog_flag(default_procedure_access, private),
+    Formal = permission_error(access, private_procedure, Culprit).

package/test/conformance/expected/iso/exceptions_and_flags.pl

@@ -1,3 +1,3 @@
 answer(7, red, caught(eyeprolog), first, caught(eyeprolog)).
 answer(7, red, caught(eyeprolog), second, caught(eyeprolog)).
-flags(off, on, [pair(bounded, false), pair(integer_rounding_function, toward_zero), pair(char_conversion, on), pair(debug, off), pair(max_arity, unbounded), pair(unknown, fail), pair(double_quotes, chars), pair(occurs_check, true)]).
+flags(off, on, [pair(bounded, false), pair(integer_rounding_function, toward_zero), pair(char_conversion, on), pair(debug, off), pair(max_arity, unbounded), pair(unknown, fail), pair(double_quotes, chars), pair(occurs_check, true), pair(default_procedure_access, private)]).

package/test/conformance/expected/iso/public_procedure_access.pl

@@ -0,0 +1,6 @@
+declared_public(moose(bertha)).
+undeclared_sibling(moose / 1).
+public_is_not_dynamic(permission_error(modify, static_procedure, elk / 1)).
+flag_default(private).
+flag_opens_every_procedure(true).
+builtins_stay_private(atom / 1).

package/test/run-regression.mjs

@@ -4987,6 +4987,112 @@ answer(Result) :- countdown(2048, Result), Result = 2048.
         assertEqual(termToString(caught.culprit), '/(atom_length, 2)', 'culprit predicate indicator');
       },
     },
+    {
+      // ISO 7.5.3 NOTE: public/1 as an extension.
+      name: 'a public/1 directive grants clause/2 access to a static procedure',
+      run: () => {
+        const program = Program.parse(':- public(elk/1).\nelk(X) :- moose(X).\nmoose(bertha).\n');
+        const solver = new Solver(program, {});
+        const answers = [...solver.solve([parseGoalText('clause(elk(_), _)')], new Env(), 0)];
+        assertEqual(answers.length, 1, 'declared public procedure is readable');
+        assertEqual(program.findGroup('elk', 1).dynamic, false, 'public does not imply dynamic');
+      },
+    },
+    {
+      name: 'a public/1 declaration still refuses database modification',
+      run: () => {
+        const solver = new Solver(Program.parse(':- public(elk/1).\nelk(bertha).\n'), {});
+        for (const goal of ['assertz(elk(clara))', 'retract(elk(bertha))']) {
+          let caught = null;
+          try {
+            [...solver.solve([parseGoalText(goal)], new Env(), 0)];
+          } catch (error) {
+            caught = error;
+          }
+          assertEqual(caught?.formal, 'permission_error(modify, static_procedure)', `${goal} is refused`);
+        }
+      },
+    },
+    {
+      name: 'public/1 applies to clauses that precede the directive',
+      run: () => {
+        const program = Program.parse('elk(bertha).\n:- public(elk/1).\n');
+        const solver = new Solver(program, {});
+        const answers = [...solver.solve([parseGoalText('clause(elk(_), _)')], new Env(), 0)];
+        assertEqual(answers.length, 1, 'earlier clauses become readable');
+      },
+    },
+    {
+      name: 'public/1 leaves undeclared procedures private',
+      run: () => {
+        const solver = new Solver(Program.parse(':- public(elk/1).\nelk(X) :- moose(X).\nmoose(bertha).\n'), {});
+        let caught = null;
+        try {
+          [...solver.solve([parseGoalText('clause(moose(_), _)')], new Env(), 0)];
+        } catch (error) {
+          caught = error;
+        }
+        assertEqual(caught?.formal, 'permission_error(access, private_procedure)', 'sibling stays private');
+      },
+    },
+    {
+      // The meta-interpreter case: no annotation on the interpreted program.
+      name: 'default_procedure_access public opens every user-defined procedure',
+      run: () => {
+        const source = ':- set_prolog_flag(default_procedure_access, public).\n' +
+          'solve(true) :- !.\n' +
+          'solve((A, B)) :- !, solve(A), solve(B).\n' +
+          'solve(H) :- clause(H, Body), solve(Body).\n' +
+          'elk(X) :- moose(X).\nmoose(bertha).\ngrazes(X) :- elk(X).\n';
+        const solver = new Solver(Program.parse(source), {});
+        const goal = parseGoalText('solve(grazes(W))');
+        const answers = [...solver.solve([goal], new Env(), 0)];
+        assertEqual(answers.length, 1, 'meta-interpreter answer count');
+        assertEqual(termToString(copyResolved(goal.args[0], answers[0])), 'grazes(bertha)', 'meta-interpreter answer');
+      },
+    },
+    {
+      name: 'default_procedure_access public keeps procedures static and built-ins private',
+      run: () => {
+        const source = ':- set_prolog_flag(default_procedure_access, public).\nmoose(bertha).\n';
+        const solver = new Solver(Program.parse(source), {});
+        for (const [goal, formal] of [
+          ['retract(moose(bertha))', 'permission_error(modify, static_procedure)'],
+          ['clause(atom(_), _)', 'permission_error(access, private_procedure)'],
+        ]) {
+          let caught = null;
+          try {
+            [...solver.solve([parseGoalText(goal)], new Env(), 0)];
+          } catch (error) {
+            caught = error;
+          }
+          assertEqual(caught?.formal, formal, `${goal} is refused`);
+        }
+      },
+    },
+    {
+      // public/1 and the flag are extensions, so the strict profile omits both.
+      name: 'strict ISO core mode offers neither public/1 nor the access flag',
+      run: () => {
+        let caught = null;
+        try {
+          Program.parse(':- public(elk/1).\nelk(bertha).\n', { isoStrict: true });
+        } catch (error) {
+          caught = error;
+        }
+        if (!caught) throw new Error('public/1 was accepted in strict ISO core mode');
+        // 8.17.4.3: an unknown flag name is a domain error, so the flag being
+        // absent from the strict profile is observable that way.
+        const solver = new Solver(Program.parse('elk(bertha).\n', { isoStrict: true }), { isoStrict: true });
+        let flagError = null;
+        try {
+          [...solver.solve([parseGoalText('current_prolog_flag(default_procedure_access, _)', { isoStrict: true })], new Env(), 0)];
+        } catch (error) {
+          flagError = error;
+        }
+        assertEqual(flagError?.formal, 'domain_error(prolog_flag)', 'flag is absent in strict ISO core mode');
+      },
+    },
     {
       // https://github.com/eyereasoner/eyeprolog/issues/96
       name: 'clause/2 keeps static procedures private in the default mode',

package/the-art-of-eyeprolog.md

@@ -6151,7 +6151,7 @@ partial list.
 
 #### Dynamic database and procedure information
 
-- **`clause(+Head,?Body)`** — Enumerates fresh copies of source clauses matching the callable `Head`; facts have body `true`. Only *public* procedures can be inspected: a procedure defined by a Prolog text is static unless a *dynamic/1* directive declares it, and a procedure first created by *assertz/1* or *asserta/1* is dynamic. Access to a static user procedure, or to a built-in, raises *permission_error(access,private_procedure)*. This applies in every execution mode, not only under `--iso-strict`, and matches the *permission_error(modify,static_procedure)* that *assertz/1* and *retract/1* already raise for the same procedures.
+- **`clause(+Head,?Body)`** — Enumerates fresh copies of source clauses matching the callable `Head`; facts have body `true`. Only *public* procedures can be inspected: a procedure defined by a Prolog text is static unless a *dynamic/1* directive declares it, and a procedure first created by *assertz/1* or *asserta/1* is dynamic. Access to a static user procedure, or to a built-in, raises *permission_error(access,private_procedure)*. This applies in every execution mode, not only under `--iso-strict`, and matches the *permission_error(modify,static_procedure)* that *assertz/1* and *retract/1* already raise for the same procedures. Normal mode additionally accepts a *public/1* directive and a `default_procedure_access` flag that open static procedures to inspection; see below.
 - **`asserta(+Clause)`, `assertz(+Clause)`** — Insert a copied fact or rule at the beginning or end of a predicate declared *dynamic/1*. Static and built-in procedures cannot be modified.
 - **`retract(+Clause)`** — Removes matching dynamic clauses one at a time on backtracking. A call sees the logical update view captured when it began. A fact pattern matches facts only.
 - **`retractall(+Head)`** — Removes every matching clause from a dynamic procedure, succeeds when none match, and keeps the empty dynamic procedure known.
@@ -6205,6 +6205,58 @@ consults another file or imports a module instead of being reset by the host
 rebuild of the program. Programs that intentionally treat an undefined
 predicate as failure must opt in with `set_prolog_flag(unknown, fail)`; bundled
 examples and non-ISO corpus cases that depend on that policy do so explicitly.
+### Reading static procedures
+
+A procedure defined by a Prolog text is static, so `clause/2` refuses it
+(ISO 7.5.2, 7.5.3, 8.8.1.3). Declaring the procedure `dynamic` lifts the
+restriction, but it also makes the procedure modifiable, and for a
+meta-interpreter it means annotating a program you may not want to edit and
+enumerating every predicate you intend to read.
+
+ISO 7.5.3 has a NOTE observing that a `public/1` directive declaring
+user-defined procedures to be public would be an extension. Normal EyeProlog
+provides it:
+
+```eyeprolog
+:- public(elk/1).
+
+elk(X) :- moose(X).
+
+moose(bertha).
+```
+
+`clause(elk(bertha), Body)` now succeeds with `Body = moose(bertha)`, while
+`moose/1` carries no declaration and stays private. A public procedure is still
+*static*: `assertz(elk(clara))` continues to raise
+*permission_error(modify,static_procedure)*. The directive grants read access
+only.
+
+To open every user-defined procedure at once, set the
+`default_procedure_access` flag to `public`:
+
+```eyeprolog
+:- set_prolog_flag(default_procedure_access, public).
+
+solve(true) :- !.
+solve((A, B)) :- !, solve(A), solve(B).
+solve(H) :- clause(H, Body), solve(Body).
+
+elk(X) :- moose(X).
+moose(bertha).
+grazes(X) :- elk(X).
+```
+
+`solve(grazes(W))` yields `W = bertha` without a single declaration on the
+interpreted program. The flag changes access, not mutability or existence:
+procedures remain static, and built-in procedures remain private, so
+`clause(atom(_), _)` still raises *permission_error(access,private_procedure)*.
+The supported values are `private` (the default, matching ISO) and `public`.
+
+Both the directive and the flag are extensions, so strict ISO core mode offers
+neither: `public/1` is rejected as an implementation-specific directive, and
+`current_prolog_flag(default_procedure_access, _)` raises
+*domain_error(prolog_flag)*.
+
 The `occurs_check` flag is an EyeProlog diagnostic
 extension rather than an ISO-defined core flag: it is absent in strict mode,
 while normal mode keeps its `true` default and optional `error` diagnostic for
@@ -10370,7 +10422,7 @@ must preserve the same observable outcome. Additional normal-mode syntax may
 accept texts outside the strict grammar, but it may not reinterpret an accepted
 standard case.
 
-The file-based conformance corpus contains 809 cases, including 392 focused ISO cases derived from the success, failure, mode, and error behavior in ISO/IEC 13211-1 clauses 7 and 8, Part 2 modules, and Part 3 grammar rules.
+The file-based conformance corpus contains 810 cases, including 393 focused ISO cases derived from the success, failure, mode, and error behavior in ISO/IEC 13211-1 clauses 7 and 8, Part 2 modules, and Part 3 grammar rules.
 Separate exact-output suites check 210 normal examples and 61 proof examples; all executable chapter programs are parsed and their declared goals are executed. The eight-case
 playground contract suite imports the production worker, sends real reasoning
 requests through its message protocol, and crawls the served module graph for